Recruitment Privacy Notice

I. Purpose of this Recruitment Privacy Notice

1.1 This Recruitment Privacy Notice („Privacy Notice“) explains how Iute Group AS (“Iute“, “we“, “us“) manages our employer branding and recruitment process through our career site (“Career Site”) and processes the personal data of candidates we contact and applicants that apply to a position (“you”) in connection with Iute’s recruiting processes.

1.2 Please read this Privacy Notice carefully before submitting your personal data to us. By providing your personal data, you acknowledge that you have read, understood, and agreed to the terms outlined in this Privacy Notice regarding the use of your information.

II. Who We Are

2.1 For the purpose of the General Data Protection Regulation (“GDPR”) the Data Controller is Iute Group AS, a company registered in Estonia. If you have any comments or questions about this Privacy Notice, feel free to contact us at dpo@iute.com.

III. Personal Data We Collect

3.1 We may collect and process the following categories of personal data depending on your interaction with us regarding or during recruitment processes:

Purpose Data types Lawful Basis
Application handling and candidate communication CV, cover letter, work samples, contact details, salary expectations, interview and assessment data, communication content, application history Legitimate interest – to assess your suitability and manage the recruitment process, including communication with you about vacancies
AI-based analysis and video interviews CV content, video or audio recordings, AI-generated summaries or scores Legitimate interest – to enhance the consistency and efficiency of candidate evaluation; additional safeguards apply where automated processing is involved
Sourcing and profiling Publicly available profiles (e.g. LinkedIn), referrals, communications, CVs sourced via third parties Legitimate interest – to identify, evaluate, and maintain contact with prospective candidates
Site operation and analytics IP address, browser type, device info, session behavior, technical logs, cookies Legitimate interest – to operate, secure, and improve our Career Site; Consent – for cookies where legally required (see Cookie Policy)
Surveys and user feedback Contact details, communication content5 Legitimate interest – to gather insights and improve the recruitment process
Reference and background checks Reference contact details, feedback from referees Legitimate interest – to verify candidate suitability
Pre-contractual and contractual documentation Identification info, employment history, academic data, signed offers, CVs, background documents Necessary for entering into or performing an employment contract
Legal obligations and rights protection Any data relevant to the context, including contact details, application data, interview notes Legitimate interest — to establish, exercise, or defend legal claims and ensure compliance with legal obligations
IV. Sources of Personal Data

4.1 Most of the information we process is provided by you – when you apply for a position, communicate with us, or participate in interviews or assessments. This includes your CV, cover letter, salary expectations, and any other details you choose to share.

4.2 When you visit our Career Site, we collect technical and statistical data such as your IP address, browser type, session behavior, and other device-related information. This helps us understand how our site is used and improve its performance. For more details, see our Cookie Policy.

4.3 We may collect professional information from publicly available sources such as LinkedIn, job boards, or the website of your current employer.

4.4 We may receive your data through:

  • Referrals from Iute employees or external contacts;
  • Recruitment agencies, who act as data controllers before submitting your application to us;
  • References you have listed, from whom we may collect information to verify your background.

4.5 We generate additional data during the recruitment process, such as interview notes, assessment results, and communication records between you and our team.

V. Sharing Personal Data

5.1 We may share your personal data with trusted third-party processors where necessary to support our operations and deliver services. These include:

  • Service providers for supporting our employer branding and recruitment activities;
  • Analytics and marketing service providers to evaluate site performance (see our Cookie Policy for details);
  • IT and hosting providers who assist in the operation of our website and communication tools;
  • Legal or regulatory authorities when required by law.

5.2 All third-party service providers are contractually bound by strict data processing agreements (DPAs) and are required to comply with applicable data protection laws.

5.3 We do not sell, rent, or otherwise commercially share your personal data with third parties under any circumstances.

VI. International Data Transfers

6.1 As a general rule we do not transfer your personal data outside the EU/EEA. However, if such a transfer is necessary – for example, when using service providers based outside the EU/EEA – we ensure that it is done lawfully and with appropriate safeguards.

6.2 This includes transfers to countries with an adequacy decision from the European Commission or under standard contractual clauses or equivalent safeguards that ensure your data remains protected.

6.3 We also implement appropriate technical and organizational measures to secure your data during and after transfer, based on what is effective and technically feasible.

6.4 If you would like more information about these transfers or the safeguards in place, please contact us using the details provided below.

VII. Data Retention

7.1 We retain personal data only as long as necessary for the purposes described above:

  • Contact form submissions: up to 1 year.
  • Job applications: up to 1 year.
  • Career Site visitors data: up up 1 year.
  • Cookie data: see Cookie Policy for details.

7.2 We may retain data longer where legally required or if necessary to resolve disputes or enforce agreements.

7.3 If no specific retention period is stated, we determine the appropriate timeframe based on the nature of the data and the purpose for which it was collected.

VIII. Your Rights as a Data Subject

8.1 To the extent required by applicable data protection regulations, you have all the rights of a data subject as regards your personal data. Such rights include the following:

  • Right to access – know what personal data we hold and obtain a copy.
  • Right to rectification – correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) – request deletion under certain conditions.
  • Right to restrict processing – suspend processing under specific circumstances.
  • Right to data portability – receive your data in a structured, commonly used format.
  • Right to object – to processing based on legitimate interest.
  • Right to withdraw consent – at any time without affecting past lawful processing.
  • Right to lodge a complaint – with us or a supervisory authority (see below).

8.2 We will respond to your request within one month in accordance with the GDPR. No fee is required unless requests are unfounded or excessive.

8.3 To exercise your rights, you can:

  • Visit the Data & Privacy page on our Career Site
  • Log in to your account and adjust your settings
  • Contact us at dpo@iute.com
IX. Lodging a Complaint

9.1 If you believe your rights have been violated, you can contact us at dpo@iute.com or lodge a complaint with the Data Protection Inspectorate of Estonia:

X. Changes to this Notice

10.1 We reserve the right to update this Privacy Notice. All changes will be posted on this page, and significant changes will be communicated via our website.

Last updated: July 24, 2025